Mobile-Related Threats by Avast for Q1/2022 (Adware, Bankers, PremiumSMS, Ransomware)
https://decoded.avast.io/threatresearch/avast-q1-2022-threat-report/
https://decoded.avast.io/threatresearch/avast-q1-2022-threat-report/
Avast Threat Labs
Avast Q1/2022 Threat Report - Avast Threat Labs
Cyberwarfare between Ukraine and Russia Foreword The first quarter of 2022 is over, so we are here again to share insights into the threat landscape and what we’ve seen in the wild. Under normal circumstances, I would probably highlight mobile spyware related…
👍7😁2😱1
Samsung Flow - Any App Can Read The External Storage CVE-2022-28775
A rogue application could use this issue to read contents on the device's external storage without requiring the proper Android permissions
https://labs.f-secure.com/advisories/samsung-flow-any-app-can-read-the-external-storage/
A rogue application could use this issue to read contents on the device's external storage without requiring the proper Android permissions
https://labs.f-secure.com/advisories/samsung-flow-any-app-can-read-the-external-storage/
👍6
Samsung Galaxy - Any App Can Install Any App In The Galaxy App Store CVE-2022-28776
This new intent received by the Galaxy App Store could be manipulated in such a way that the Galaxy App Store would be forced to automatically install other applications onto the victim's device without consent
https://labs.f-secure.com/advisories/samsung-galaxy-any-app-can-install-any-app/
This new intent received by the Galaxy App Store could be manipulated in such a way that the Galaxy App Store would be forced to automatically install other applications onto the victim's device without consent
https://labs.f-secure.com/advisories/samsung-galaxy-any-app-can-install-any-app/
👍6
Warning: GRIM and Magnus Android Botnets are Underground
https://www.fortinet.com/blog/threat-research/grim-magnus-android-botnets
https://www.fortinet.com/blog/threat-research/grim-magnus-android-botnets
Fortinet Blog
Warning: GRIM and Magnus Android Botnets are Underground | FortiGuard Labs
Since the beginning of 2022, there are more Android botnet newcomers. FortiGuard Labs has seen two new banking botnets: GRIM and Magnus. Read our blog to find out more.…
👍2
Mobile subnoscription Trojans and their little tricks
https://securelist.com/mobile-subnoscription-trojans-and-their-tricks/106412/
https://securelist.com/mobile-subnoscription-trojans-and-their-tricks/106412/
Securelist
The Trojan subscribers Joker, MobOk, Vesub and GriftHorse
Kaspersky analysis of mobile subnoscription Trojans Joker (Jocker), MobOk, Vesub and GriftHorse and their activity: technical denoscription and statistics.
👍11👏3
The noscript to install important Android Pentesting tools & configure genymotion emulator automatically with tools
https://xenion0.github.io/xenion/posts/Android-install/
https://xenion0.github.io/xenion/posts/Android-install/
Xenion
Android Pentest Setup Environment
Android pentesting Setup Environment
👍16❤6
Reversing an Android sample which uses Flutter
https://cryptax.medium.com/reversing-an-android-sample-which-uses-flutter-23c3ff04b847
https://cryptax.medium.com/reversing-an-android-sample-which-uses-flutter-23c3ff04b847
Medium
Reversing an Android sample which uses Flutter
Flutter is a framework able to build multi-platform apps (e.g. iOS and Android) from a single code base. The same source code is able to…
👍31
Google Play Store App with 10,000+ Served Android Teabot/Anatsa Banking Trojan
https://labs.k7computing.com/index.php/play-store-app-serves-teabot-via-github/
https://labs.k7computing.com/index.php/play-store-app-serves-teabot-via-github/
K7 Labs
Play Store App Serves Teabot Via GitHub
We at K7 Labs recently came across this twitter post aboutTeabot (aka ‘Anatsa’) a banking Trojan. The main infection vector […]
👍2
0-day ACE discovered in iOS/macOS that has been actively exploited in-the-wild found in AppleAVD that was patched in March - CVE-2022-22675
https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22675.html
https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22675.html
👍6
Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys
https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html
https://www.trendmicro.com/en_us/research/22/e/fake-mobile-apps-steal-facebook-credentials--crypto-related-keys.html
Trend Micro
Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys
We recently observed a number of apps on Google Play designed to perform malicious activities such as stealing user credentials and other sensitive user information, including private keys.
👍11
A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned
https://www.usenix.org/conference/usenixsecurity22/presentation/shen
https://www.usenix.org/conference/usenixsecurity22/presentation/shen
When Wireless Malware Stays On After Turning Off iPhones
demo: https://youtu.be/KrqTHd5oqVw
paper: https://arxiv.org/pdf/2205.06114.pdf
demo: https://youtu.be/KrqTHd5oqVw
paper: https://arxiv.org/pdf/2205.06114.pdf
YouTube
[Paper Teaser] Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones
The full paper will be presented at ACM WiSec 2022, the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, from May 16 to May 19, 2022.
*** ACM WiSec 2022 ***
The 15th ACM Conference on Security and Privacy in Wireless and Mobile…
*** ACM WiSec 2022 ***
The 15th ACM Conference on Security and Privacy in Wireless and Mobile…
👍33😁2🤮2
Vulnerability in Huawei's AppGallery can download paid apps for free
https://evowizz.dev/blog/huawei-appgallery-vulnerability
https://evowizz.dev/blog/huawei-appgallery-vulnerability
evowizz.dev
Vulnerability in Huawei's AppGallery can download paid apps for free
How I discovered the vulnerability in Huawei's AppGallery, the consequences and what happened
👍13🤮6
Comparing root detection on banking apps with latest version of Magisk
https://markuta.com/magisk-root-detection-banking-apps/
https://markuta.com/magisk-root-detection-banking-apps/
Markuta
Comparing root detection on banking apps with latest version of Magisk
Comparing root detection on 24 banking apps using the latest version of Magisk v24.3 on a Google Pixel 3a running Android 10.
👍18❤1😢1
Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks
https://research.nccgroup.com/2022/05/15/technical-advisory-ble-proximity-authentication-vulnerable-to-relay-attacks/
https://research.nccgroup.com/2022/05/15/technical-advisory-ble-proximity-authentication-vulnerable-to-relay-attacks/
👍5
Protecting Android users from 0-Day attacks
Denoscription of 3 campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email. Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.
Compromise flow:
website redirect -> deliver browser exploit -> load ALIEN malware -> load PREDATOR payload
https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/
Denoscription of 3 campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email. Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.
Compromise flow:
website redirect -> deliver browser exploit -> load ALIEN malware -> load PREDATOR payload
https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/
Google
Protecting Android users from 0-Day attacks
To protect our users, Google’s Threat Analysis Group (TAG) routinely hunts for 0-day vulnerabilities exploited in-the-wild. In 2021, we reported nine 0-days affecting Ch…
👍12
Android security checklist: theft of arbitrary files
https://blog.oversecured.com/Android-security-checklist-theft-of-arbitrary-files/
https://blog.oversecured.com/Android-security-checklist-theft-of-arbitrary-files/
News, Techniques & Guides
Android security checklist: theft of arbitrary files
Developers for Android do a lot of work with files and exchange them with other apps, for example, to get photos, images, or user data.
🔥12👍5
New version of Android banking trojan ERMAC 2.0 is available on the underground market and already has an active campaign https://blog.cyble.com/2022/05/25/ermac-back-in-action/
Cyble
ERMAC Malware Back In Action: New Threats And Attack Methods
ERMAC malware is back with improved capabilities, targeting Android devices with enhanced threat techniques. Learn about its actions, impact, and how to defend against this evolving mobile malware
🔥7👍6
Notification implicit PendingIntent in Android NextCloud app allows to access contacts (CVE-2022-24886) https://hackerone.com/reports/1161401
HackerOne
Nextcloud disclosed on HackerOne: Notification implicit...
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq
👍5